TTTPS — Byzantine Audit API

Proof-of-Time · Byzantine Fault Detection · IETF Draft · Commercial Audit Tool

One cryptographic proof chain — regulator-ready audit across jurisdictions: tamper-rejecting at ingress, tamper-evident after write — operator-independent.

EU AI Act GPAI/Art.53 · Aug 2, 2026 (confirmed) · high-risk (Art.12) deferred to Dec 2027 (Digital Omnibus, provisional)

MiFIR Art.22c EU AI Act Art.12/53 DORA Art.17 MAS TRM Korea AI Basic Act CoE AI Treaty — In Force
2,056
req/s HTTP E2E (GCP 2vCPU · k6 500VU)
~16K
req/s est. (100GbE colocation · 16-core · linear scale)
143B
wire format (IETF draft-helmprotocol-tttps-03)
7+6
Byzantine attack vectors — 7 detected live, 6 roadmap (13 total)
Multi
jurisdiction — one chain
The Problem

One clock is one point of trust.

Distributed systems — inference clusters, CDN networks, payment processors, telco signaling — lean on timestamps to sequence events, block replays, and satisfy regulators. But one clock is one point of trust. Compromise the NTP server, spoof the GPS signal, inject a false clock update — and the entire audit trail is corrupt. Traditional systems catch it after the fact, or never.

TTTPS closes this at the protocol level. Every attestation anchors to multiple independent time sources at once — NIST Roughtime and network time; GPS and colocation PTP (±1µs, SVC target); GEO/KTSat ±10ns — roadmap — bound into a cryptographic commitment chain. Manipulate one source and the others disagree — detected instantly. Replay the same token and the chain registers a verifiable collision.

Overview

Anchored to many sources, not one.

Most systems trust a single clock. Wrong by drift, or compromised by NTP injection or GPS spoofing — the whole audit trail goes with it, and nothing inside the system can tell.

TTTPS anchors every token to multiple independent sources at once — NIST Roughtime and network time; GPS and colocation PTP (±1µs, SVC target); GEO/KTSat ±10ns — roadmap — across one commitment chain. Manipulate one and the rest disagree. The divergence is logged with the exact attack type, so the trail survives even under active attack.

Replay is just as visible: submit a token twice and the chain collides on the second verify. No trust in the submitter, no trust in the network — only that the commitment is internally consistent.

Why Tampering Doesn't Work

Three independent layers close every angle of attack.

Three independent layers close every angle of attack — from the moment a token arrives to the moment a regulator reads the log.

1. Tamper-rejecting at ingress Replayed, stale, or cross-context inputs are refused at the protocol boundary — before any record is written. Wrong context, past its window, or submitted twice: discarded outright. It never enters the chain.
2. Hash-linked + Ed25519-signed Each event commits to the previous chain digest. Edit anything after write — however small — and the hash breaks, visible to any verifier. The Ed25519 signature over the final digest cannot be recomputed without the private key.
3. Independently verifiable Verification needs only the published public key. The operator holds no privileged position and cannot silently rewrite history. Submitter, counterparty, and regulator all read the same evidence — none has to trust the others.

Result: operator-independent, regulator-ready evidence — the chain speaks for itself.
Attack Detection Capability Matrix

Every angle, named and logged.

7 attack vectors actively detected (6 on roadmap) via cryptographic commitment chain and temporal verification.

Attack TypeDetection MechanismLayerLog Field
Token ReplayCommitment chain collision — same token submitted twice yields mismatch on second verifyApplicationattack_type: "REPLAY"
Timestamp DriftMulti-source time anchor cross-check; delta exceeds ±10 ms thresholdProtocolattack_type: "DRIFT"
Signature ForgeryEd25519 signature verification against published pubkey failsCryptographicattack_type: "FORGE"
Flood DDoSRate-limit token bucket per ctx_id; excess requests flaggedTransportattack_type: "FLOOD"
Ordering AttackChain digest sequence check; out-of-order submission breaks chain integrityProtocolattack_type: "ORDERING"
Cross-Pool Replayctx_id binding in commitment; token from pool A rejected by pool BApplicationattack_type: "CROSS_POOL"
SybilIdentity multiplicity detected via convergent commitment patterns across ctx_idsApplicationattack_type: "SYBIL"
GPS SpoofingTime anchor from GPS cross-referenced with network time; divergence triggers alertPhysicalattack_type: "GPS_SPOOF"
NTP InjectionMultiple independent time sources compared; single-source manipulation isolatedNetworkattack_type: "NTP_INJECT"
BGP HijackingRoute-origin commitment verified against signed prefix advertisementNetworkattack_type: "BGP_HIJACK"
DNS PoisoningResolution binding in token; mismatched endpoint detected at verify stepNetworkattack_type: "DNS_POISON"
SDN Flow ManipulationPath-fingerprint delta comparison; altered flow topology breaks commitmentNetworkattack_type: "SDN_MANIP"
Protocol ViolationSchema validation on all fields; malformed token structure rejected at ingressApplicationattack_type: "PROTO_VIOLATION"
Lattice Commitment Pipeline

Every stage narrows the attack surface.

Multi-stage cryptographic commitment architecture. Each stage narrows the attack surface.

Multi-source time anchors → lattice-based integrity pipelineHMAC-SHA256Ed25519 signature

Cryptographic primitives: Ed25519 signing · blake3 keyed hash · 143-byte wire format (IETF draft-helmprotocol-tttps-03)
All manipulation at any stage converges to commitment mismatch at verify.

The pipeline ingests independent time sources — NIST Roughtime, network time; GPS and colocation PTP (±1µs, SVC target); GEO/KTSat ±10ns — roadmap — and computes a layered commitment, sealed with an Ed25519 signature over the final chain digest. Tamper at any stage, by any vector, and verification returns a mismatch.

SealingSwitch — Turbo / Full

Adaptive sealing mode based on time-source quality.

ModeConditionLatencyUse Case
TurboPTP sync available (±10µs)Fast path — blake3 keyed root onlyHigh-frequency inference, CDN delivery, payment rails
FullPTP unavailable / clock drift detectedFull lattice pipelineRegulatory submission, cross-border compliance, audit export

Note: internal pipeline architecture proprietary. Contact peter@kenosian.com for technical deep-dive under NDA.

Real-World Attack Scenarios

Attacks traditional audit systems miss entirely.

How TTTPS catches attacks that traditional audit systems miss entirely.

AttackWhat HappensHow TTTPS Catches ItLog Field
NTP InjectionAttacker compromises NTP server, advances clock 30s to replay old transactionsGPS and Roughtime anchors disagree with the manipulated NTP anchor — multi-source consensus failsattack_type: "NTP_INJECT"
Token ReplaySame API request submitted twice with identical timestamp tokenCommitment chain registers a collision on second submission — mathematically impossible for two valid unique tokensattack_type: "REPLAY"
Signature ForgeryAttacker intercepts and modifies payload, attempts to recompute signatureEd25519 verification fails against published public key — no valid signature possible without the private keyattack_type: "FORGE"
GPS SpoofingAttacker broadcasts false GPS time signal to ground infrastructureRoughtime and NTP anchors disagree with GPS — cross-source delta exceeds ±10ms thresholdattack_type: "GPS_SPOOF"
Ordering AttackAttacker reorders a sequence of legitimate tokens to alter apparent event historyChain digest sequence check breaks — out-of-order submission violates chain integrityattack_type: "ORDERING"
Live Demo · No API key required · Rate-limited

Generate, verify, watch a replay get rejected.

Calls api.kenosian.com live — shows token + Byzantine audit result
Click the button to generate a PoT token and verify it in real time.

Or via curl:

Step 1: Generate a token

curl -X POST https://api.kenosian.com/api/demo/pot/generate \
  -H "Content-Type: application/json" \
  -d '{"ctx_id":"demo"}'

Expected response:

{
  "status":         "ok",
  "ctx_id":         "demo",
  "timestamp_ms":   1748000000000,
  "lattice_commitment": "a3f9c2...",
  "chain_digest":   "b7c2e1...",
  "signature":      "ed25519-base64...",
  "pubkey":         "acac8eae..."
}

Step 2: Verify (replay attack detection)

curl -X POST https://api.kenosian.com/api/demo/pot/verify \
  -H "Content-Type: application/json" \
  -d '{"ctx_id":"demo","token":"<paste token from step 1>"}'

Step 3: Trigger replay detection

# Submit same token twice → REPLAY detected
curl -X POST https://api.kenosian.com/api/demo/pot/verify \
  -H "Content-Type: application/json" \
  -d '{"ctx_id":"demo","token":"<same token>"}'
{"valid":false,"attack_type":"REPLAY"}
Audit Log

A structured query, not guesswork.

curl "https://api.kenosian.com/audit?ctx_id=demo&window=3600" \
  -H "X-API-Key: <your-key>"

Response (real measurement basis):

{
  "ctx_id": "demo",
  "window_secs": 3600,
  "total_requests": 142,
  "byzantine_total": 3,
  "byzantine_ratio": 0.021,
  "attack_breakdown": { "REPLAY": 2, "DRIFT": 1, "FORGE": 0, "FLOOD": 0 }
}

Prometheus metrics:

curl https://api.kenosian.com/metrics
tttps_attack_total{type="replay"}   2
tttps_attack_total{type="drift"}    1
tttps_byzantine_ratio               0.021
When to Use TTTPS

When you need to prove when, not just that.

TTTPS is the right tool when you need to prove when something happened — not just that it happened.

Use CaseWhat TTTPS Provides
LLM inference clustersCryptographic audit trail of every KV cache transfer between prefill and decode nodes — detect replay, ordering, and forgery attacks in real time (Hydra-KV integration)
CDN / game patch deliveryPer-chunk delivery proof — any content owner or regulator can verify exactly when a chunk was delivered, to which node, and that it was unmodified (Hydra-CDN integration)
Payment processorsTimestamp every payment attestation with cryptographic proof resistant to clock manipulation — regulatory-grade tamper evidence
Telco / ISP signalingTRAI-aligned audit trail for all inter-node signaling — JSON-LD export format ready for submission
Any distributed APIByzantine attack detection on every request — REPLAY, FLOOD, FORGE, DRIFT detected and logged automatically
Regulatory Alignment

Timestamp integrity, across regimes.

TTTPS provides cryptographic proof-of-time designed to satisfy timestamp integrity requirements across financial and infrastructure regulations.

RegulationRequirementTTTPS Coverage
MiFIR Art.22c RTS
EU MiFIR Art.22c (clock-sync, RTS 25 ±1ms) — pending application date
±1ms clock synchronization for HFT; ±100µs for systematic internalisers and trading venuesMulti-source PoT via colocation PTP (±1µs, SVC target) · cryptographic divergence detection · ESMA-aligned
FINRA Rule 4590
CAT NMS Plan, US
Clock synchronization audit trailTamper-evident PoT log, queryable per-event
DORA Art.10
EU 2022/2554
ICT threat detection mechanisms7 Byzantine attack vectors detected and logged in real time (6 roadmap)
MAS TRM 2021 + AIRG 2025
Section 6.4.1 + AI Risk Mgmt Guidelines, Singapore
Financial infrastructure time auditMulti-anchor PoT with NTP + Roughtime and colocation PTP (±1µs, SVC target); GEO/KTSat ±10ns — roadmap
FCA PS17/14
UK MiFID II equivalent
Clock synchronization, audit trail integrityEd25519-signed PoT chain, designed to support forensic evidence submission
TRAI / CERT-In
India
Telecom timestamp integrity, incident reportingPoT format aligned with TRAI audit requirements; CERT-In structured evidence format
FCA MAR 7A
UK Market Abuse Regulation
Clock synchronization, audit trail integrity for trading venuesEd25519-signed PoT chain, structured for submission in FCA proceedings
FSA FIEA Art.156
Japan Financial Instruments and Exchange Act
Order management system timestamp recordsPer-event PoT log queryable per-order; JSON-LD export for FSA submission
SEC Rule 17a-3
US Securities and Exchange Commission
Records of orders, confirmations, and audit trail integrityTamper-evident PoT per transaction; Prometheus alert on Byzantine detection
ACMA Telecommunications Act
Australia
Network integrity, interoperability audit requirementsByzantine-resistant PoT chain across multi-carrier peering points
Compliance & Audit Export

Tamper-evident, ready for submission.

TTTPS generates a tamper-evident audit trail suitable for submission to regulatory bodies.

Format / OrganizationDetails
JSON-LD exportStructured, machine-readable audit records compatible with standard compliance tooling
Prometheus + GrafanaLive metrics dashboard — contact peter@kenosian.com for access
How to Deploy

Where it attaches, where it's served, what you implement.

Three questions a client asks: where does it attach, where is it served, and what do I actually implement. Concretely:

1 · Where it attaches

TTTPS binds to one layer of the transaction: pre-settlement ingestion — the moment an event enters the books, before it is committed. You do not modify the asset, the chain, or the settlement value. You seal the timing and order at the gate. Attach it to a stablecoin settlement flow and that stablecoin carries a tamper-rejecting record of when and in what order every transfer cleared — an integrity layer on top of an existing token, not a new token.

2 · Where it is served

The verification engine runs off-chain, on a data-center fabric — co-located with the systems that move at payment and inference speed. It can be served on a DC fabric or self-hosted; either is supported, neither is a precondition. An on-chain anchor is optional — commit a periodic chain digest on-chain when you want long-lived public anchoring for audit, and skip it when you do not.

What it is not: an Ethereum-only deployment. Settling integrity proofs through block confirmation alone inherits block latency — seconds, not microseconds — which is unfit for real-time payment and agent settlement. TTTPS runs at fabric speed and treats the chain as an optional anchor, not the critical path.

3 · What you implement

Three steps, dropped into the existing flow — no chain change, no reissuance:

1 · Bind. At ingestion, each event is sealed with a Proof of Time token — its timestamp and position in the order, signed. One call at the point of execution.
2 · Reject. A backdated, replayed, or reordered event is refused at the gate, before it is written. Tamper-rejecting, not tamper-detecting.
3 · Verify. Any counterparty or regulator replays the trail and checks each proof with the published public key — operator-independent audit evidence, no access to your infrastructure required.
Deployment

Open reference, IETF in active submission.

Open-source reference implementation. IETF draft in active submission.

npm install openttt

GitHub: github.com/helm-protocol/openttt
IETF Draft: datatracker.ietf.org/doc/draft-helmprotocol-tttps/
Production API: peter@kenosian.com

Target Deployment — Fabric Tenants

Illustrative targets, pre-engagement.

Target accounts on colocation fabric — illustrative, pre-engagement (LOI stage). Revenue figures are estimated potential ARR, not contracted.

Tier 1 — Institutional  ·  €12,000/mo

Target Client (Fabric tenant)IBXRegulationValue (projected)
Goldman SachsLD4, NY4MiFIR Art.22c + DORA + EU AI Act€144K/yr (projected)
JPMorgan ChaseLD4, NY4, TY3MiFIR Art.22c + DORA + EU AI Act€144K/yr (projected)
Morgan StanleyLD4, NY4MiFIR Art.22c + DORA€144K/yr (projected)
Deutsche BankFR5, LD4EU AI Act GPAI + DORA€144K/yr (projected)
BNP ParibasFR5, LD4EU AI Act + MiFIR Art.22c + DORA€144K/yr (projected)
HSBCLD4, HK1MiFIR Art.22c + DORA + MAS TRM€144K/yr (projected)
MUFG / NomuraTY3, TY5FSA + MiFIR Art.22c€43K/yr (projected)

Tier 2 — MiFID Pro  ·  €3,600/mo

Target Client (Fabric tenant)IBXRegulationValue (projected)
Citadel SecuritiesLD4, NY4, CH1MiFIR Art.22c RTS — pending application date€43K/yr (projected)
OptiverAM3, CH1MiFIR Art.22c€43K/yr (projected)
IMC TradingAM3, NY4MiFIR Art.22c€43K/yr (projected)
Virtu FinancialNY4, LD4MiFIR Art.22c + FINRA CAT€43K/yr (projected)
Flow TradersAM3, LD4MiFIR Art.22c€43K/yr (projected)
GroqSV1EU AI Act GPAI (colocation fabric)€43K/yr (projected)
Lambda LabsSV1EU AI Act GPAI€43K/yr (projected)
CoreWeaveSV1, NY2EU AI Act GPAI€43K/yr (projected)

Target PoPs: LD4 · FR5 · AM3 · NY4 · NY2 · CH1 · SK1 · HK1 · TY3 · TY5 · SV1

Pricing

One subscription, Byzantine detection included.

Fixed monthly subscription — up to 50M events/month (fair-use). All tiers include Byzantine detection, multi-source Roughtime validation, and audit log retention.

TierPriceIncludes
Compliance €300/month Up to 50M events/month (fair-use) · Byzantine detection · 90-day audit log · Prometheus · JSON-LD export
MiFID Pro €3,600/month All Compliance features · MiFIR Art.22c RTS · KTSat GEO path (±10 ns, roadmap) · SLA 99.9% · dedicated onboarding
Institutional €12,000/month All MiFID Pro features · custom retention · co-location support Contact

Market reference: DigiCert timestamp authority $0.10–0.50/token. TTTPS: up to 50M events/month (fair-use cap) with multi-source Roughtime + Byzantine detection included.
Annual contract: 2 months free.  ·  Included in all Hydra product bundles.  ·  Hydra-Audit: standalone or bundled (Contact).

API Access

Production API key required.
Contact peter@kenosian.com for access and onboarding.

TierRate LimitAudit Log RetentionAccess
Demo10 req / min1 hourNo key required
ProductionCustom90 dayspeter@kenosian.com
Industry policy direction
“Third-party evaluation could be done by a government agency (similar to the FAA) or a set of private organizations that are authorized and inspected by the government.”
Dario Amodei, “Policy on the AI Exponential” (2026-06) · darioamodei.com
How this maps. TTTPS is the implementation of this pattern — operator-independent timestamp evidence that makes the “accurately measure what is happening” standard achievable.
Get Started

The CoE AI Convention is in force since 2025-11-01. Signed by EU, UK, US et al.; ratified by EU, UK, France, Norway and others. US: signed (not ratified). A TTTPS chain generated at the moment of your AI operation provides cryptographic evidence structured for submission across CoE signatory frameworks.

One cryptographic seal. Designed to support submission across CoE signatory frameworks. GPAI (Art.53) enforcement: August 2, 2026.

2026 Global AI Regulatory Enforcement Timeline — jurisdiction-by-jurisdiction breakdown, enforcement dates

Trust Mark
TTTPS
Verifiable
WHEN
proposed
“TTTPS-certified” — the trust mark TTTPS issues (proposed)

TTTPS produces a verifiable, tamper-rejecting record of when an event occurred and in what order — the timing-integrity primitive every Hydra product builds on. If TTTPS is adopted as the standard, a conforming deployment could carry the “TTTPS-certified” mark, signalling that its records are anchored to verifiable time rather than to a self-asserted clock.

Proposed mark for explanation only. Any “certified” status is conditional (“could / if adopted”) and would operate under the Kenosian root of trust — not a present-day certification program.